c3cd80691f58665d0232ac31569abb6bd0d2480d450c1f9c0aec0c3e27655892

Analysis

max time kernel
126s
max time network
144s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31370970c1eb12740ed68224612f9fe3_JaffaCakes118.html
Size

17KB
MD5

31370970c1eb12740ed68224612f9fe3
SHA1

d8207c88d03bcacfbb4bc381467991cafbbf6583
SHA256

c3cd80691f58665d0232ac31569abb6bd0d2480d450c1f9c0aec0c3e27655892
SHA512

6d804deca95a035b1ba898a437b0a60f66c4f8fed2006c6ff3f49f1b59565c4439247b40b1e3164bd450deedea64cc0460dfe9285647eff288d29bb52717b1c6
SSDEEP

384:ldWQ+Bo8J7wnJkjQW1IbFIzVcdWQ+Bo8J7wnJkjQWl:vWQ+BTUnJkjVuFIzqWQ+BTUnJkjF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000fe6ac6a03c0b908a80c7e230200d910c4260016bfa7676042d40438feab1a757000000000e8000000002000020000000a5b9ee06d05c1159159b119adf5ab2cc057313581143c445d1e5421320e30ae49000000092a16c6557a42d3577815dca4f0c59ba5fd5304d0e6cef0992dc5e707e0e257cecaa515f4161f6c54f2272c04b6c73e610cdd02d0ddffa011495fb6c369172d3d3e2c8eb22b23047109abefe2e9c5c6d7885017148926ec9e1bfd021ca2ded04cd240d4145b252fbc927fdefa25a1b4115d069d5e9eaa52514a5e798d74756a57d2979b118fb11a58336745cfd33c06e40000000687fa6d886b22e5dfb87487900a489dfd42837ece872ffb714ff3a6147af3f01590a5058c1b4725e0717dcb8522cd17e666969d91dcb14bf1053df7a4a0873fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426708246"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000003da8d0769d030033f3c4814023340427dc6cc72194c60889ef01e7f03d0c132a000000000e80000000020000200000000256ef9fa2d18ff4bfbf2e3ddba6d06e411fce7e0dd4ee2a0eb76cdb77dd65c820000000666217037cfedf7a3690f1c1affa811a89d494ec52ea88767efd6efd2141498940000000e6636c69cac65622fc206c6280a076b064f38e13b0ad21bc6e1237632859a8aac9ff68ee5d0ec617befacfd4d76673b4d75942f6b9c1fa1ccf0ffd25c24a9038	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47ED6721-3E19-11EF-BBDF-EA452A02DA21} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407bce3726d2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2732	2264	iexplore.exe	30
PID 2264 wrote to memory of 2732	2264	iexplore.exe	30
PID 2264 wrote to memory of 2732	2264	iexplore.exe	30
PID 2264 wrote to memory of 2732	2264	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31370970c1eb12740ed68224612f9fe3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e92aa6d88701ff7c021f3b69a80b4552

SHA1
e7fe3277d90c1946a6047c7d0cf52a077bd4cdfb

SHA256
a9c7a11b1f96d4ef35e97fee17dec6c1418d8a8a5ca69e333b1d1ae354e53ffc

SHA512
b021b4ed324f1d7c82500abf0a5b1ed9e2c159a46a5d37666041e697faaed51060e02bc4344bbb2a69c4ddc05b72a5e43ee6df7a032aca7411995f52604fd674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ab96130c538d3cf66626dbe5b769955

SHA1
4d67e3ef68292d0ca47a4218226dc29995355ba7

SHA256
12d51d9edb11c7b9ddd22f126ce95d34d748a8f0423d2c41690545cd592091d4

SHA512
e1ad2f087f57a56247599163b169b1e4c5afc5640eef28474e3e12b2b8018bd9b90c69d7b295b34b4aa8cd06432640abea264681ef0d4a7a7e377395bf617ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ca1cd50ca36f9b56f623b30a53cd718

SHA1
bf17b337dc3aeea6fb9b5e9882e5b01650345de8

SHA256
ff24dcf34f7dd3a155d82fdf8020c634ae844bd6b22104c90935011805e1e4be

SHA512
c13ea47dcb4705c82c09505262e161a5ad3c58e32b2fa69911ac0e72fd24b3b73f99dfd97e47e62b62beee59440670746741e61dfbbbc0b8bba52607a91fbedd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ace8361dca66a8c81a940f0a84998b45

SHA1
2a6275c95ae1b12ba7288d72e4c6eafd2ae31518

SHA256
14c5791e423bd6f8aef55b0165393277c7e251bcd91cff9ef5e5547fa345d993

SHA512
eb20549c0f65030c3e1e0330bc863df6fd4226c2757132e2a52bd313380df0a3031b08019a6e4fee0ac5f074a2fbc1e6f566c646d1314ba3e4032063fc3ff893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20c356e2add3ee1858817542fea5d75d

SHA1
ed1064fec8c012055cb58888b32faf78ac631480

SHA256
678735b60686c0de7fd3c1f2af8826ca509df82777fcad2f349c1baf284ff4b9

SHA512
c935061163965392c96e56c349340a45c151a86cd9beb508d1b3d1477b276a72a95a306cb398efa1582dc2f87abbf51bdef7890e919f368bb6e40ea113677604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56baa17de2dd3ad57d4e4313b3e17497

SHA1
37474ee79124673b4c296b1ef2615e206017e73c

SHA256
18122402f2a781fbd4e22e394e087c3810c6eabd7f3d0507d96afba5efdfd403

SHA512
f8f46fb2bf87b97c9cf33616d6964abd7601695e7fce848ca9fa41d4601a2bd5d570bc459c873f2f7c69cffdba3de5c67656685808f20da8491cdfddb2e81b5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f91068ee906d707eea0891e260b6380c

SHA1
1c2fbe843e989a72b914445732245708293b0c05

SHA256
af65031c320785792b32747ac825b22df3e87e9eeb54ee676e5619917ceafc22

SHA512
4615a7830127d23ce656fed8488989ed79a970766da4f41d06bfa3c1e06d483dc750b7d522b6bdb09c9b99468feccc355bac788d34aafe613dbec161e54a9f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a6e28282dc27a1a1ed1205aea09bd5e

SHA1
602f8e47bccf98f41838c3ca6e2140a4a12d56e6

SHA256
158053a129ce73ae891e61ff124dc88acdab7e83d0edee8df77fc43c5b095ea4

SHA512
565b799073b2c8270b462b48a2658738c6c31d723ee5ac170860e3171ab544f67c95ea3f3699e50f51777a94cf713dd76ff9214f5dc1ba0fc8563b6a7be8befd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
970e91a4fcf2f4e1ecf2f3373eb13140

SHA1
56af98ffe7250db2db6f0c778e85dc1f4fb83921

SHA256
066f652924b8fc66ce26cedfa99d89c84a9e4e38772b2bf6d17f34d146b538d0

SHA512
b4dc9b100a9561ad5cc89adc3b499dbd7ba6a2c0d05c8d3d9a5e5ea457c3b5a1d7d13a85aa802394729ff029c380fd1e1502f90a042ae34375f97df73971de23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6100752725e946c0b1c9fb60e67d94ca

SHA1
d6d964be27bd154e01baa2e65ee2fb579c922df7

SHA256
46de444beb189e0dbb32cfee39785c21fba24e48a46aa5884bc8b1e950c22c6f

SHA512
9e0d7a2628966d47e4be1c397f83d70faee26fc7f6a6a854ed03a8c5dea5d7e3e45f17acf233067f8f85f32e42325284d380f2c1300477dfeae335031d25bace

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
778116738d1e5cc6f6c6d26bf3e086f6

SHA1
997cb9af8928c09994098fae2724e45beae197b6

SHA256
f680c096f73d6c1be14b7ed0d335ad26bc4ce01240df1bdd4e91c390c8e1aeda

SHA512
afc3aad08c378445aa45bbeb049df089c5350a929e421fad33e310015563ec228e9d321ce84cca54c85f957c5a384f672143c484de57bc185c946a7ae2e69690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a90f0e5371cadc6b373f5a6979c51b8

SHA1
363ebc43d18a6f61dbce8a7da70ec62a89ecda3b

SHA256
cc6205cebe5b60b77798a90d643a17a9c042a4b5a6e6fb626a66aa14c14c359e

SHA512
70635f59070e04e34f09b9adfc917b8f9cb4b090825f781defdb418a9c25c7c82d69df9c3e0140cfcec214e389a8186739eb3d6e8f47dc89b5963eac2cd8d9b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cba4d05339df1499feed0ca2e62747f3

SHA1
20f432b52f123d4c2a48f0e39e99bd36e451a6c6

SHA256
aefb171f567cbc82c52885fb1bbc54a356be119e5fd05d899c5e7b47848d2300

SHA512
d414941e1ff429c457977c975d8d99947e07fb33b977428adeb247dd38938ef016073fb8c6ea1d242e424affda152fceba8bd90be6420a87e4811f92887901e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
367f115cb33c3a6c1a246fb274c10fa2

SHA1
53e36e6edebcb32dbac9091860cb52e16bb4a958

SHA256
d9d21e3d6c8add374191a8527e13ef029311def65709dd2d7ed6852fd10688c3

SHA512
04e1309de579cc3e621b1a94d1b4e3c1a5b290e875386d89340f2ff8a0db3f6972cf9755f22b8babaae7c9af23a4334dc0d90b6fb41c7d761325d049eb4fe101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JQ7VMQEC\CVGGI4E9.htm

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab790.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar793.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit